Under normal circumstances, there’s no need for you to change UEFI settings. If you change these settings, you risk the security of your Surface. But if you ever need access to the firmware features of your Surface, here's the basic info:

Configure Alternate System Boot Order To choose the order in which your Surface boots, select Configure Alternate System Boot Order and select one of the following options:

SSD only

Network -> USB -> SSD

USB -> Network -> SSD

USB -> SSD

Network -> SSD

Advanced Device Security This option lets you disable ports and features you don’t want anyone to use. For example, you can disable the microSD card reader so no one can use a microSD card to copy data.

The current setting appears in bold. Select Advanced Device Security and select the option you want:

Note

Selecting Side USB disables the ability to boot from a USB device. The USB port remains enabled in Windows.

Administrator Password This option lets you create a password to prevent others from changing the UEFI settings. Organizations that need to protect sensitive information typically use an administrator password.